Security readout for executives and security teams
Plain-English summary
CVE-2022-31414 is a reported buffer overflow in D-Link DIR-1960 firmware DIR-1960_A1_1.11. A crafted HTTP request could crash or disrupt the device. For executives, the main concern is router availability and possible exposure of internet-facing management services.
Executive priority
Treat as high priority for exposed or business-critical routers. Prioritize inventory, management-plane isolation, and vendor firmware verification. Risk is lower for devices not externally reachable and already updated or retired.
Technical view
The CVE describes CWE-120 in prog.cgi, reported via srtcat, affecting D-Link DIR-1960 firmware DIR-1960_A1_1.11. The CVSS 3.1 vector is network, low complexity, no privileges, no user interaction. The description says DoS, while the vector lists high confidentiality impact, so impact evidence is inconsistent.
Likely exposure
Exposure is most likely where D-Link DIR-1960 devices run firmware DIR-1960_A1_1.11 and expose the HTTP management interface to untrusted networks. The source bundle provides no CPEs and lists affected vendor/product as n/a, so inventory confirmation is necessary.
Exploitation context
The source bundle does not show CISA KEV listing or source-supported active exploitation. A public GitHub bug report is referenced, indicating public technical disclosure. Do not assume exploitation in the wild from these sources alone.
Researcher notes
The CVE record gives a high CVSS score and unauthenticated network vector, but affected metadata is incomplete and impact wording conflicts with the vector. Base conclusions on confirmed firmware, reachable management surface, and vendor guidance.
Mitigation direction
- Check D-Link security bulletin and support pages for vendor guidance.
- Upgrade firmware if D-Link provides a fixed release for this model.
- Disable external access to the router management interface.
- Restrict management access to trusted networks or VPN only.
- Replace unsupported devices if no maintained firmware is available.
Validation and detection
- Inventory D-Link DIR-1960 devices and firmware versions.
- Confirm whether DIR-1960_A1_1.11 is present.
- Verify HTTP management is not internet-exposed.
- Review device logs for crashes, restarts, or suspicious HTTP errors.
- Compare findings with current D-Link advisory and support records.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31414 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.dlink.com/en/security-bulletin/CVE reference · x_refsource_MISC
- https://tsd.dlink.com.tw/ddgoCVE reference · x_refsource_MISC
- https://github.com/Davidteeri/Bug-Report/blob/main/dlink-dir1960-%200x42acdc.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.